How are 'Bytes' counted in ACC and traffic logs?

[Hiren_Patel]

Hi All,

One of our customers has blocked the 'Music' category in URL Filtering but when we filter the 'Music' Category in ACC, it shows total bytes for the last 7 days as 5 GB.

So what do bytes really represent? Why does it show 5 GB when the category is blocked? 

Please explain this in detail.

Regards,
Hiren

[reaper]

Hi @Hiren_Patel

Bytes are counted whenever packets traverse the firewall, they represent bytes of data

If you're seeing 5GB, the question should be: how is music passing through if it is blocked? maybe they forgot to enable the profile on a security policy

Did they enable the policy recently? if it's only been enabled for a few days, they may need to wait for the next full week before there will no longer be any connections counted towards the week 

[EdKulb]

I have a similar question about the Network Activity ACC for Source and Destination Activity sorted by "Bytes".  The problem I have with these views is they seem to be showing sessions that were still open during the "Time" filter as opposed to having been created during the specified time.    Let's say we selected "Last Hour".  In my experience we may see the Source IP Activity ACC wiget show a source at the top of the list with a large byte count for 1 session that was open for months (and was still open in the "Last Hour".  I asked it to show me stuff going on the last hour, not a session that opened months ago.  Is this not what we should expect?

[BPry]

@EdKulb,

That would be due to the session closing within the last hour. The ACC tab simply reads the logs within the last hour; it doesn't matter if that session started within the last hour as long as the log was generated within the last hour. 

This is completely normal and expected behavior. 

[EdKulb]

Makes perfect sence, thanks.

[JenaKerenza]

It is completely reasonable to consult more attractive and completely free content.